使用csi驱动程序从Vault检索机密，返回“permission denied”

Question

我可以使用curl获取一个令牌：

curl \
--request POST \
--data '{"jwt": "'$TOKEN_REVIEW_SJWT'", "role": "teste-role"}'\
http://<ip>:8200/v1/auth/kubernetes/login

我能够vault login <token>和阅读秘密的vault read secret/data/k8s-secret。但是当我部署一个pod来测试它的时候，返回的是“permission denied”。

Warning  FailedMount  103s (x23 over 32m)   kubelet, <ip>  MountVolume.SetUp failed for volume "secrets-store-inline" : rpc error: code = Unknown desc = failed to mount secrets store objects for pod csi/nginx-secrets-store-inline, err: rpc error: code = Unknown desc = error making mount request: couldn't read secret "k8s-secret": Error making API request.

URL: GET http://<vault-ip>:8200/v1/%!!(MISSING)E(MISSING)2%!C(MISSING)secret/data/k8s-secret%!!(MISSING)E(MISSING)2%!D(MISSING)
Code: 403. Errors:

* 1 error occurred:
  * permission denied

Pod状态：

kubectl get pods -n csi
NAME                                 READY   STATUS    RESTARTS   AGE
csi-secrets-store-csi-driver-4n789   3/3     Running   0          24h
csi-secrets-store-csi-driver-8zfbp   3/3     Running   0          10d
csi-secrets-store-csi-driver-b6hqv   3/3     Running   0          10d
vault-csi-provider-f488v             1/1     Running   0          11d
vault-csi-provider-l2982             1/1     Running   0          24h
vault-csi-provider-zztxb             1/1     Running   0          10d

安装vault provider和csi驱动程序的步骤：

helm install vault hashicorp/vault -n csi\
  --set "server.enabled=false" \
  --set "injector.enabled=false" \
  --set "csi.enabled=true"

helm install csi secrets-store-csi-driver/secrets-store-csi-driver -n csi

Pod yaml使用秘诀：

kind: Pod
apiVersion: v1
metadata:
 name: nginx-secrets-store-inline
 namespace: app
spec:
 containers:
 - image: nginx
   name: nginx
   volumeMounts:
   - name: secrets-store-inline
     mountPath: “/mnt/secrets-store”
     readOnly: true
 serviceAccountName: app-sa
 volumes:
   - name: secrets-store-inline
     csi:
       driver: secrets-store.csi.k8s.io
       readOnly: true
       volumeAttributes:
         secretProviderClass: vault-secret

Answer 1

当我从SecretProviderClass中删除双引号时，我能够创建pod。

objects: |
   - objectName: password
     secretPath: secret/data/k8s-secret/
     secretKey: password